Every place the forge starts a process is listed in one test, each with the reason its arguments are never a person's text #10942

test/spawn-sites.test.ts now lists every file under src/ that starts a process: 34 files, each with one line saying why its arguments are fixed or validated. The test scans src/ for Bun.spawn, Bun.spawnSync, Bun.$, spawn or $ imported from "bun", and child_process. A process-starting file that isn't on the list fails the test, which names the file. So does a listed file that no longer starts a process. docs/ARCHITECTURE.md gets one line under Hygiene saying where the list lives. No behaviour changes.

What to look at:

• The reasons are the review. They describe what the arguments are; they don't say no person's text ever reaches them. Three places carry text someone wrote, and their entries say so:

- src/apps/process.ts and src/apps/tty.ts run a repository's forge.json command through /bin/sh -c when there is no cell. That command is written by someone with write access to the repository, not taken from a request. - src/crew/claude.ts and src/crew/plan.ts pass an issue's text as a single prompt argument after its flag, never through a shell.

• Count: the issue estimated 37 files. The real count is 34: the rough grep also caught test files inside src/ (*.test.ts, which the scan skips), mentions in comments and regex $ signs. The test checks itself that comments, typeof Bun.spawn and regex $ don't count as sites.
• What's left out: the check is per file, not per call, so a second spawn added to a listed file isn't flagged. A per-call list would break every time code shifted lines. I also didn't cover processes started indirectly, such as new Worker.

The keep_plan tool wasn't available in this run, so the issue's plan wasn't updated.

To try it: bun test test/spawn-sites.test.ts passes (5 tests). Add Bun.spawn(["ls"]) to any file in src/ and it fails, naming that file. bun scripts/gate.ts and bun x tsc --noEmit both pass.

🤖 Generated with Claude Code

Closes #10934

test/spawn-sites.test.ts now lists every file under src/ that starts a process: 34 files, each with one line saying why its arguments are fixed or validated. The test scans src/ for Bun.spawn, Bun.spawnSync, Bun.$, spawn or $ imported from "bun", and child_process. A process-starting file that isn't on the list fails the test, which names the file. So does a listed file that no longer starts a process. docs/ARCHITECTURE.md gets one line under Hygiene saying where the list lives. No behaviour changes.

What to look at:

• The reasons are the review. They describe what the arguments are; they don't say no person's text ever reaches them. Three places carry text someone wrote, and their entries say so:

- src/apps/process.ts and src/apps/tty.ts run a repository's forge.json command through /bin/sh -c when there is no cell. That command is written by someone with write access to the repository, not taken from a request. - src/crew/claude.ts and src/crew/plan.ts pass an issue's text as a single prompt argument after its flag, never through a shell.

• Count: the issue estimated 37 files. The real count is 34: the rough grep also caught test files inside src/ (*.test.ts, which the scan skips), mentions in comments and regex $ signs. The test checks itself that comments, typeof Bun.spawn and regex $ don't count as sites.
• What's left out: the check is per file, not per call, so a second spawn added to a listed file isn't flagged. A per-call list would break every time code shifted lines. I also didn't cover processes started indirectly, such as new Worker.

The keep_plan tool wasn't available in this run, so the issue's plan wasn't updated.

To try it: bun test test/spawn-sites.test.ts passes (5 tests). Add Bun.spawn(["ls"]) to any file in src/ and it fails, naming that file. bun scripts/gate.ts and bun x tsc --noEmit both pass.

🤖 Generated with Claude Code